Credential Rotation

Expiring an existing set of credentials and reissuing a new valid set

How it works

Management servers with enterprise policies for account management provide the ability to change or reset passwords for accounts. Some organizations rotate credentials periodically to limit the risk of stolen credentials.

Considerations

• When responding to an incident, severity of compromise should be considered to determine what credentials to what accounts should be regenerated
• If proactively rotating credentials periodically, several factors should be considered to determine the frequency. Also introduces some risk including promoting the creation of weak passwords and poor storage practices for employees and presents challenges in proper tracking.